Navigating CVE-2026-66066: Threat details, affected components, and how to stay protected
CVE-2026-66066: What You Need to Know
On July 29, 2026, Rails released patches and an advisory for CVE-2026-66066, an arbitrary file read vulnerability in Active Storage that can enable remote code execution (RCE)
Exploiting this vulnerability also requires the use of libvips < version 8.13
Fastly Next-Gen WAF customers can enable our new virtual patch (released July 31, 2026) to gain immediate protection against exploitation attempts while the underlying components are patched.
Affected components
Active Storage
< 7.2.3.2, 8.0 up to 8.0.5.1, 8.1 up to 8.1.3.1
Mitigating this vulnerability requires updating both Active Storage and libvips
Active Storage
>= 7.2.3.2, >= 8.0.5.1, >= 8.1.3.1
libvips
>= 8.13
What are the impacts of CVE-2026-66066?
CVE-2026-66066 is an arbitrary file read vulnerability, meaning it enables an attacker to read arbitrary files (and process memory) from a vulnerable web server. If certain files are read, an attacker can use this to gain remote code execution on the vulnerable server. For more in-depth details on the exact cause of the vulnerability, see Ethiack’s detailed research post.
What to do next: Virtual patching and remediation
While our virtual patch mitigates the vast majority of attack vectors, edge cases may exist depending on your specific environment and configuration. Applying the official patches to Active Storage and libvips as soon as possible remains the best way to ensure total protection.
To enable the virtual patch, follow the enablement instructions in our official documentation.
If you are concerned about potential exploitation, Rails has also published details on how to perform forensics for this vulnerability. This includes a forensics repo with Claude skills to assist in forensics.
References
Rails advisory & technical details:
Research from Ethiack: